Shai-Hulud: Nkọwa nke ngwugwu npm Worm

Mmetụta nke Mwakpo Shai-Hulud Supply Chain Mwakpo

Shai-Hulud ka na-arụ ọrụ taa. Ikpuru a na-eme ka usoro ihe mberede ahụ dị ngwa ngwa. Ihe were izu ole na ole na trojan na-eme ugbu a n'ime awa ole na ole. N'ihi ya, Mgbasa ahụ na-adị ngwa ngwa ma sie ike ijide. Ọ na-aga n'ihu site na:

• Izu ohi npm bipụta tokens na ihe nzuzo GitHub.
• Mbipụtaghachi onwe ya n'ime ngwugwu npm ndị ọzọ.
• Ịgbakwunye usoro ọrụ GitHub Actions ọjọọ maka ntachi obi.

Onye ọ metụtara:

A na-ekpughe otu ọ bụla nke na-etinye ngwugwu npm ọha. Ọzọkwa, ndị mmepe nwere ihe nchekwa npm ma ọ bụ GitHub na-eche nnukwu ihe egwu ihu. Ndị na-agba ọsọ CI nke na-eji ihe nzuzo sara mbara nwekwara ike ịdaba.

Ihe ize ndụ azụmahịa

Mmetụta azụmaahịa na-eto ngwa ngwa. Ihe nrịbama ndị e zuru nwere ike ibute iweghara akaụntụ, izu ohi ngwugwu, na ọbụna iji igwe ojii eme ihe n'ụzọ na-ezighị ezi. Na mgbakwunye, ịnọgidesi ike na usoro ọrụ GitHub na-eme ka ọ sie ike ihicha. Ya mere, ọ na-esiri ike ihicha., otu ndị otu ga-ewere Shai-Hulud dị ka ihe na-eme n'oge na-adịghị anya, ọ bụghị ihe mechiri emechi.

Otu Shai-Hulud Supply Chain Wakporo Si arụ ọrụ na ngwugwu npm

Ebumnuche na ebumnuche nke onye mwakpo

Mgbasa ozi ahụ na-eme ka ihe atọ dị mma:

• Ebumnobi mbụ bụ zuru asambodo n'ọtụtụ site na laptọọpụ ndị nrụpụta na ndị na-agba ọsọ CI. Nke a gụnyere tokens npm publish, tokens GitHub, na nzere ígwé ojii. N'ezie, ọtụtụ nyocha na-akwado nchịkọta nzuzo usoro, dịka ịgba TruffleHog na ịjụ ajụjụ na njedebe metadata ígwé ojii.
• Ebumnobi nke abụọ bụ ime gbasaa na akpaghị aka site n'iji ikike mbipụta nke ndị na-elekọta ndị e kewapụrụ n'ihe ize ndụ eme ihe n'ụzọ na-ezighị ezi. N'ihi ya, otu ebe na-agbasa ngwa ngwa ruo ọtụtụ, ebe ọ bụ na ụdị ọhụrụ nke ngwugwu ndị ọzọ na-ebute ọrịa na-apụta na-enweghị mgbalị mmadụ ọzọ.
• Ebumnobi nke atọ bụ ime nọgide na-aga ma na-awụpụ mmiri n'ụzọ a pụrụ ịdabere na ya site na akụrụngwa GitHub. Ndị mwakpo na-emepụta ebe nchekwa ọha nke akpọrọ "Shai-Hulud" nke nwere ntọala abụọ64 data.json, na mgbakwunye ha na-akụ usoro ọrụ nke na-ahazi usoro ${{ toJSON(ihe nzuzo) }} ma tinye ya na njikọ weebụ kwụ ọtọ.

Uru a ga-enweta gụnyere ohere ogologo oge ịnweta ndekọ na koodu isi mmalite, mmegharị ngwa ngwa n'akụkụ akaụntụ igwe ojii, na nhọrọ iji ngwa agha mee ka usoro ọkọnọ ahụ dịkwuo mma. Akụkọ ọha na eze na-egosi na e tinyere ihe nchekwa nkeonwe n'ihu ọha na "-mbugharị" mgbakwunye, nke na-eme ka ikpughe data na ọsọ dịkwuo elu

N'ime Shai-Hulud Payload: ngwugwu.js Ngwugwu npm

Shai-Hulud na-arụ ọrụ dị ka buru ibu, ejiri Webpack kee ya ma kpụọ ya nke ukwuu Faịlụ JavaScript (ngwugwu.js, ihe dị ka 3–3.7 MB) nke na-arụ ọrụ site na nrụnye mgbe etinyere banye ngwugwu.jsonN'ihi ya,, Ntinye ọ bụla na-akpali ibu ọrụ ahụ na akpaghị aka. Nhazi a na-ezochi ihe njirimara, na-agbakọta usoro njikwa, ma na-akwali ihe niile n'ime otu ihe ochie nke na-arụ ọrụ n'oge nrụnye. Ndị nyocha na-akwado mgbe niile na njikọta Webpack, nha faịlụ pụrụ iche, na mmejuputa oge nrụnye.

Ị ga-ahụ ihe atụ ndị na-egosi na ihe ndị na-egbochi mmadụ ime ihe ọjọọ na ihe ndị na-eme ka mmadụ ghara ime ihe ọjọọ:

• Eserese modulu pere mpe yana NJ modulu ọnụọgụgụ, okwu ndị dị obere, na usoro njikwa dị larịị., Nhazi a na-eme ka nyocha aka sie ike nke ukwuu.
• Izochi eriri site na akwa base64 na ndị enyemaka owuwu. Dịka ọmụmaatụ, Usoro nhazi na nhazi base64 ugboro ugboro na-apụtakarị n'akụkụ usoro mwepụ ihe.
• Nzipu ike site eval-ụdị ụkpụrụ na ahụ ọrụ emepụtara, si otú a na-eme ka koodu nwee ike ịgbanwe omume n'oge ọrụ.
• Nzacha OS ịhọrọ ụdị Linux na macOS kachasị na laptọọpụ ndị na-agba ọsọ CI na ndị mmepe.

Site n'akụkụ ọrụ, ngwugwu ahụ bụ modular. Writeups na-akọwa modulu maka nchọpụta OS, sistemụ faịlụ na nyocha nzuzo git, ohere SDK ígwé ojii, ọrụ GitHub API, na injin mgbasa ozi nke na-edezi ngwugwu ndị ọzọ onye na-elekọta nwere. N'ezie, StepSecurity na ReversingLabs na-egosipụta ọrụ nke na-emelite ngwugwu na akpaghị aka na njikọ ọjọọ.

Mmezu Oge Ntinye na Shai-Hulud: Otu Ngwugwu npm si akpalite Worm

Mwakpo ahụ na-amalite mgbe postinstall na-agba ọsọ node ngwugwu.js. N'oge a, edemede ahụ na-amalite ma na-ekpughe ọnọdụ ọrụ na ebe nchekwa, na-edozi usoro maka ọrụ zuru oke nke ikpuru ahụ.

Nchọpụta na owuwe ihe ubi

• Payload dumps process.env ma na-enyocha faịlụ mpaghara maka ihe nzuzo entropy dị elu na prefixes tokens. Na mgbakwunye, ọ na-agbasa mkpuchi site na iji TruffleHog.
• Ọ na-ajụ ajụjụ maka njedebe metadata igwe ojii iji chịkọta nzere ndị na-adịru nwa oge. Dị ka ọmụmaatụ, oku na-aga 169.254.169.254 na AWS ma ọ bụ metadata.google.internal na GCP na-apụtakarị na ndị ọbịa nwere ọrịa.
• N'ihi ya, Asambodo ọ bụla achọtara ga-adị mfe iji bipụta ngwugwu npm ọhụrụ ma ọ bụ kwalite usoro ọrụ GitHub.

Exfiltration

• Ikpuru ahụ na-emepụta ebe nchekwa GitHub ọhụrụ aha ya bụ Shai Hulud ma dee koodu nke nwere ntọala abụọ64 data.json yana nkọwa ikpo okwu, ebe a na-ekpofu ihe dị n'ime gburugburu ebe obibi, na ihe nzuzo. Dịka a pụrụ ịhụ, omume mkpọtụ a dị mfe ịchọpụta ma ọ bụrụ na ndị na-agbachitere maara ebe ha ga-ele anya.
• Ọ na-akụkwa usoro ọrụ GitHub Actions, ọtụtụ mgbe n'alaka aha ya bụ shai-hulud, nke na-ahazi usoro ${{ toJSON(secrets) }} ma tinye data ahụ na njikọ weebụ na-anaghị agbanwe agbanwe. Ọzọkwa, usoro ọrụ a na-aga n'ihu ruo mgbe mmadụ wepụrụ ya nke ọma.

Mgbasa Ozi

• Site na ihe nrịbama npm ọ bụla achọpụtara, ibu ọrụ ahụ na-akọwapụta ngwugwu niile nke onye na-elekọta ihe ahụ mebiri emebi nwere. Mgbe ahụ, ọ na-ewepụta tarball ọ bụla, na-etinye bundle.js na ntinye postinstall, ma na-ebipụtaghachi ngwugwu ahụ.
• N'ihi ya, ọtụtụ ngwugwu ndị butere ọrịa nwere ike ịpụta n'ime awa ole na ole, na-amụba radius mgbawa ahụ n'ofe usoro ahụ dum.

Nkwụsi ike na ikpughe

• Ikpuru ahụ na-eme ka usoro ọrụ ọjọọ dị ndụ, n'ọtụtụ oge, na-atụgharị ebe nchekwa nkeonwe nye ọha na eze site na "-mbugharị" Mgbakwunye. N'ozuzu ya, nke a na-eme ka onye na-awakpo ahụ nwee ike ịnọgide na-enwe ọnọdụ ma na-eme ka mwepụta data dịkwuo elu.

Ihe nchọpụta isi
Ojiji a na-adịghị ahụkebe ${{ toJSON(secrets) }} na Actions workflows dị ụkọ. Ya mere, Ndị otu kwesịrị iwere ya dị ka ihe ngosi dị elu n'oge ịchụ nta.

Usoro ọrụ dị mkpa ị kwesịrị ịchọ

Ojiji a na-adịghị ahụkebe na JSON (ihe nzuzo) na Actions bụ ihe ngosi dị elu na ihe omume a.

Koodu pseudo nke mgbasa ozi dị elu (nchekwa, nkọwa)